Subprocessors
Ommelo uses a small set of trusted providers to run the service. Each processes personal data only on our instructions. This is the current list.
Effective 31 July 2026
Current subprocessors
| Provider | Purpose | Data processed | Region |
|---|---|---|---|
| Supabase | Database, authentication, file/object storage, and encrypted secrets (Vault). | Account (email, name), audit inputs and results, extension recordings, encrypted test credentials. | Australia (ap-southeast-2) |
| Anthropic | Claude API — analyses audit and extension content to generate findings. | Audit inputs (URLs, screenshots, serialized DOM text) and captured session content sent for analysis. | United States |
| Vercel | Application hosting and content delivery. | Request/technical metadata (IP, user agent) inherent to serving the app. | United States |
| Lemon Squeezy | Payments and subscription management (merchant of record). | Billing details and subscription status. We do not receive or store card numbers. | United States |
| Google sign-in (OAuth); our own GA4 web analytics on the marketing site and sign-in flow (opt-in only, see Cookie Policy); and, where a customer connects it, read-only GA4 analytics on their own property. | OAuth profile (email, name); for visitors who opt in, standard GA4 usage data (pages viewed, device/browser, approximate location from IP); read-only GA4 token and per-step session counts when a customer connects their own property. | United States | |
| Sentry | Error monitoring on server routes. | Error diagnostics and technical metadata, scrubbed of tokens and secrets. | United States |
Changes
We keep this list current as our providers change. Business and team customers under our Data Processing Agreement are entitled to advance notice of new subprocessors so they can object. For how these providers fit into our overall handling of personal data, see the Privacy Policy.